Tag: #bug-bounty15 results
OpenAI initiates GPT-5.5 bug bounty program targeting bio safety vulnerabilities. Microsoft teams with Helion Energy for zero-carbon power to fuel AI growth. Nvidia invests 8% of portfolio in edge AI chips eyeing $200B market amid AI-driven semi boom.
OpenAI launches GPT-5.5 Bio Bug Bounty as a red-teaming challenge. It targets universal jailbreaks posing bio safety risks. Rewards scale up to $25,000 for top findings.
Security researcher Aonan Guan exploited prompt injection vulnerabilities in AI agents from Anthropic, Google, and Microsoft via GitHub Actions integrations, stealing API keys and tokens. The companies paid bug bounties—$100 from Anthropic, $500 from GitHub, and an undisclosed amount from Google—but issued no public advisories.
OpenAI launches a Safety Bug Bounty program to crowdsource AI risk detection. It focuses on abuse cases like agentic vulnerabilities, prompt injection, and data exfiltration.
AI is identifying software vulnerabilities faster than human researchers, putting major bug bounty programs under pressure. Microsoft paid a record amount, Apple restricted researcher submissions, and Google adjusted its pricing.
HackerOne has stopped accepting new vulnerability reports due to a flood of low-quality AI-generated 'junk reports,' exhausting their review capacity. This impacts major OSS projects relying on their bug bounty program. Google faces similar pressures from AI-spam in its programs.
Vibe-coding platform Lovable denied a researcher's vulnerability report allowing free accounts to access other users' credentials, chat history, and source code. The company first cited 'intentional behavior' and unclear documentation, then blamed bug-bounty platform HackerOne. Critics call this a poor response to security disclosures.
Apple has introduced report quotas and a 30-day cool-off period after AI-generated and low-quality vulnerability submissions overwhelmed its security teams. The company is using internal AI systems from Anthropic and OpenAI to triage reports, while trusted researchers may receive quota extensions.
Apple has introduced submission quotas and a 30-day cooling-off period in its internal vulnerability reporting portal. The measures aim to prevent security teams from being overwhelmed by large volumes of low-quality, AI-generated reports.
A security researcher claims AMD took 124 days to patch a vulnerability and subsequently altered its bug bounty terms to avoid paying a $10,000 reward. This incident has sparked significant industry debate regarding corporate ethics in security disclosure.